# Flatcar Container Linux Release - 2022-06-09

## lts-2605.28.1
- AMD64-usr
- Platforms succeeded: All
- Platforms failed: None
- Platforms not tested: None

VERDICT: _GO_

## Communication

---

#### Guidelines / Things to Remember

- Release notes are used in a PR and will appear on https://www.flatcar-linux.org/releases/
- [Announcement Message](#Announcement-Message) is posted in [Flatcar-Linux-user](https://groups.google.com/g/flatcar-linux-user). Make sure to post as “Flatcar Container Linux User”, not with your personal user (this can be selected when drafting the post).
- Make sure the the LTS (channel) is referred to as `LTS-2021`, and not `LTS-2605`
---

### Announcement Message

Subject: Announcing new LTS-2021 2605.28.1 releases.

Hello,
We are pleased to announce a new Flatcar Container Linux release for the LTS-2021 channel.

# New **LTS-2021** Release **2605.28.1**

_Changes since **LTS-2021 2605.27.1**_

## Security fixes:

- Linux: [CVE-2022-28390](https://nvd.nist.gov/vuln/detail/CVE-2022-28390), [CVE-2022-1158](https://nvd.nist.gov/vuln/detail/CVE-2022-1158), [CVE-2022-1353](https://nvd.nist.gov/vuln/detail/CVE-2022-1353), [CVE-2022-30594](https://nvd.nist.gov/vuln/detail/CVE-2022-30594), [CVE-2022-1198](https://nvd.nist.gov/vuln/detail/CVE-2022-1198), [CVE-2021-4197](https://nvd.nist.gov/vuln/detail/CVE-2021-4197), [CVE-2022-28389](https://nvd.nist.gov/vuln/detail/CVE-2022-28389), [CVE-2022-1516](https://nvd.nist.gov/vuln/detail/CVE-2022-1516), [CVE-2022-1204](https://nvd.nist.gov/vuln/detail/CVE-2022-1204), [CVE-2022-1205](https://nvd.nist.gov/vuln/detail/CVE-2022-1205), [CVE-2022-29581](https://nvd.nist.gov/vuln/detail/CVE-2022-29581), [CVE-2022-28388](https://nvd.nist.gov/vuln/detail/CVE-2022-28388), [CVE-2022-1836](https://nvd.nist.gov/vuln/detail/CVE-2022-1836), [CVE-2022-1048](https://nvd.nist.gov/vuln/detail/CVE-2022-1048), [CVE-2022-1734](https://nvd.nist.gov/vuln/detail/CVE-2022-1734), [CVE-2022-0494](https://nvd.nist.gov/vuln/detail/CVE-2022-0494), [CVE-2022-28893](https://nvd.nist.gov/vuln/detail/CVE-2022-28893), [CVE-2022-1729](https://nvd.nist.gov/vuln/detail/CVE-2022-1729), [CVE-2022-0854](https://nvd.nist.gov/vuln/detail/CVE-2022-0854), [CVE-2022-26490](https://nvd.nist.gov/vuln/detail/CVE-2022-26490), [CVE-2022-28356](https://nvd.nist.gov/vuln/detail/CVE-2022-28356), [CVE-2022-1016](https://nvd.nist.gov/vuln/detail/CVE-2022-1016), [CVE-2022-27666](https://nvd.nist.gov/vuln/detail/CVE-2022-27666)

## Updates:

- Linux ([5.4.196](https://lwn.net/Articles/896224/) from 5.4.188)
- ca-certificates ([3.78](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_78.html))

Best,
The Flatcar Container Linux Maintainers

---
### Security

**Subject**: Security issues fixed with the latest LTS-2021 2605.28.1 releases

**Security fix**: With the LTS-2021 2605.28.1 releases we ship a fix for the CVEs listed below.

#### LTS-2021

* Linux
* [CVE-2022-26490](https://nvd.nist.gov/vuln/detail/CVE-2022-26490) CVSSv3 score: 7.8(High)
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.
* [CVE-2022-28356](https://nvd.nist.gov/vuln/detail/CVE-2022-28356) CVSSv3 score: 7.5(High)
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
* [CVE-2022-1016](https://nvd.nist.gov/vuln/detail/CVE-2022-1016) CVSSv3 score: n/a
* [CVE-2022-27666](https://nvd.nist.gov/vuln/detail/CVE-2022-27666) CVSSv3 score: 7.8(High)
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
* [CVE-2022-28390](https://nvd.nist.gov/vuln/detail/CVE-2022-28390) CVSSv3 score: 7.8(High)
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
* [CVE-2022-1158](https://nvd.nist.gov/vuln/detail/CVE-2022-1158) CVSSv3 score: n/a

* [CVE-2022-1353](https://nvd.nist.gov/vuln/detail/CVE-2022-1353) CVSSv3 score: 7.1(High)
A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.
* [CVE-2022-30594](https://nvd.nist.gov/vuln/detail/CVE-2022-30594) CVSSv3 score: 7.8(High)
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
* [CVE-2022-1198](https://nvd.nist.gov/vuln/detail/CVE-2022-1198) CVSSv3 score: n/a
* [CVE-2021-4197](https://nvd.nist.gov/vuln/detail/CVE-2021-4197) CVSSv3 score: 7.8(High)
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
* [CVE-2022-28389](https://nvd.nist.gov/vuln/detail/CVE-2022-28389) CVSSv3 score: 7.8(High)
mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
* [CVE-2022-1516](https://nvd.nist.gov/vuln/detail/CVE-2022-1516) CVSSv3 score: 5.5(Medium)
A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.
* [CVE-2022-1204](https://nvd.nist.gov/vuln/detail/CVE-2022-1204) CVSSv3 score: n/a
* [CVE-2022-1205](https://nvd.nist.gov/vuln/detail/CVE-2022-1205) CVSSv3 score: n/a
* [CVE-2022-29581](https://nvd.nist.gov/vuln/detail/CVE-2022-29581) CVSSv3 score: n/a
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
* [CVE-2022-28388](https://nvd.nist.gov/vuln/detail/CVE-2022-28388) CVSSv3 score: 7.8(High)
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
* [CVE-2022-1836](https://nvd.nist.gov/vuln/detail/CVE-2022-1836) CVSSv3 score: n/a
* [CVE-2022-1048](https://nvd.nist.gov/vuln/detail/CVE-2022-1048) CVSSv3 score: 7(High)
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.
* [CVE-2022-1734](https://nvd.nist.gov/vuln/detail/CVE-2022-1734) CVSSv3 score: 7(High)
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
* [CVE-2022-0494](https://nvd.nist.gov/vuln/detail/CVE-2022-0494) CVSSv3 score: 4.4(Medium)
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
* [CVE-2022-28893](https://nvd.nist.gov/vuln/detail/CVE-2022-28893) CVSSv3 score: 7.8(High)
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
* [CVE-2022-1729](https://nvd.nist.gov/vuln/detail/CVE-2022-1729) CVSSv3 score: n/a
* [CVE-2022-0854](https://nvd.nist.gov/vuln/detail/CVE-2022-0854) CVSSv3 score: 5.5(Medium)
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.

---

### Twitter

_The tweet (from [@flatcar](https://twitter.com/flatcar)) goes out after the changelog update has been published; it includes a link to the web changelog._

New Flatcar releases now available for Alpha, Beta, Stable, LTS
📦 Package updates for Linux TODO
📜 Release notes at the usual spot: https://www.flatcar.org/releases/